wm policy from dan

Changelog

@@ -37,6 +37,7 @@
 	ulogd (Dan Walsh)
 	varnishd (Dan Walsh)
 	webadm (Dan Walsh)
+	wm (Dan Walsh)
 	xguest (Dan Walsh)
 	zosremote (Dan Walsh)
 

policy/modules/apps/wm.fc

@@ -0,0 +1,3 @@
+/usr/bin/twm		--	gen_context(system_u:object_r:wm_exec_t,s0)
+/usr/bin/openbox	--	gen_context(system_u:object_r:wm_exec_t,s0)
+/usr/bin/metacity	--	gen_context(system_u:object_r:wm_exec_t,s0)

policy/modules/apps/wm.if

@@ -0,0 +1,98 @@
+## <summary>X Window Managers</summary>
+
+#######################################
+## <summary>
+##	The role template for the wm module.
+## </summary>
+## <desc>
+##	<p>
+##	This template creates a derived domains which are used
+##	for window manager applications.
+##	</p>
+## </desc>
+## <param name="role_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="user_role">
+##	<summary>
+##	The role associated with the user domain.
+##	</summary>
+## </param>
+## <param name="user_domain">
+##	<summary>
+##	The type of the user domain.
+##	</summary>
+## </param>
+#
+template(`wm_role_template',`
+	gen_require(`
+		type wm_exec_t;
+	')
+
+	type $1_wm_t;
+	domain_type($1_wm_t)
+	domain_entry_file($1_wm_t, wm_exec_t)
+	role $2 types $1_wm_t;
+
+	allow $1_wm_t self:fifo_file rw_fifo_file_perms;
+	allow $1_wm_t self:process getsched;
+	allow $1_wm_t self:shm create_shm_perms;
+
+	allow $1_wm_t $3:unix_stream_socket connectto;
+
+	domtrans_pattern($3, wm_exec_t, $1_wm_t)
+
+	kernel_read_system_state($1_wm_t)
+
+	corecmd_bin_domtrans($1_wm_t, $3)
+	corecmd_shell_domtrans($1_wm_t, $3)
+
+	dev_read_urand($1_wm_t)
+
+	files_read_etc_files($1_wm_t)
+	files_read_usr_files($1_wm_t)
+
+	mls_file_read_all_levels($1_wm_t)
+	mls_file_write_all_levels($1_wm_t)
+	mls_xwin_read_all_levels($1_wm_t)
+	mls_xwin_write_all_levels($1_wm_t)
+	mls_fd_use_all_levels($1_wm_t)
+
+	auth_use_nsswitch($1_wm_t)
+
+	miscfiles_read_fonts($1_wm_t)
+	miscfiles_read_localization($1_wm_t)
+
+	userdom_manage_home_role($2, $1_wm_t)
+	userdom_manage_tmpfs_role($2, $1_wm_t)
+	userdom_manage_tmp_role($2, $1_wm_t)
+
+	optional_policy(`
+		dbus_system_bus_client($1_wm_t)
+	')
+
+	optional_policy(`
+		xserver_role($2, $1_wm_t)
+	')
+')
+
+########################################
+## <summary>
+##	Execute the wm program in the wm domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`wm_exec',`
+	gen_require(`
+		type wm_exec_t;
+	')
+
+	can_exec($1, wm_exec_t)
+')

policy/modules/apps/wm.te

@@ -0,0 +1,10 @@
+
+policy_module(wm, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type wm_exec_t;
+corecmd_executable_file(wm_exec_t)